I found some interesting topics by searching for sql_last_value.
This post below demonstrates using sql_last_value and how to actually update documents.
As you said, it might be best to use mysql primary key as document id to handle any updates.
Only issue I have with that is I remember reading if you let elasticsearch handle document id the bulk index is much faster?
The only action left then is delete. If record has been removed, will logstash handle that also?
Regards,
Shane.